Delphi-compiled ransomware targeting Russian-speaking cybercrime. C2: shopping-na-divane.ru and shoptorgvlg.ru (/system/logs/tool/inst.php). Developer/operator email: Johnmen.24@aol.com. Uses FGIntRSA (Delphi RSA library) for key encryption. File encryption markers: {ENCRYPTSTART}/{ENCRYPTENDED}. Pre-2000 timestamp manipulation.
Russian Delphi ransomware 0442cfab .Ransomware extension 379KB. C2: shopping-na-divane.ru + shoptorgvlg.ru /inst.php. Email: Johnmen.24@aol.com. FGIntRSA RSA. ENCRYPTSTART/ENCRYPTENDED markers.
レポートを読む →